EUVD-2026-70584
GHSA-427j-7j55-4h7g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unauthenticated endpoint, no special conditions; bounded impact (listing modification/deletion only) supports I:L/A:L with C:N and no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
AnalysisAI
Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoints that should require authorization, allowing remote attackers to perform unauthorized write operations affecting directory listings and plugin data. The root cause is CWE-862 (Missing Authorization) - the plugin omits capability or permission checks on one or more AJAX or form handlers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond having the Business Directory plugin active on a publicly accessible WordPress installation running version 6.4.26 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) establishes a low-barrier, unauthenticated, network-reachable attack with bounded impact - limited integrity modification and limited availability disruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Business Directory plugin to a version beyond 6.4.26; the exact patched release should be confirmed via the WordPress Plugin Repository changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-26-broken-access-control-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Business Directory
View allThe Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.
Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote at
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows auth
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access o
Broken Access Control in the Business Directory WordPress plugin (versions 6.4.23 and below) permits unauthenticated rem
Cross-site scripting in the Business Directory WordPress plugin (versions 6.4.22 and earlier) allows authenticated subsc
Unauthenticated cross-site scripting in the Business Directory WordPress plugin (versions <= 6.4.22) allows remote attac
Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin - Easy Listing Dire
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today